Database
WordPress vulnerabilities listed in CISA KEV (page 1349)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- Critical9.8Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.4.4Update to 0.4.5
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Critical9.9Authenticated SQL Injection
BSK PDF Manager
<1.5Update to 1.5
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin
<5.0.5Update to 5.0.5
- Critical9.8SQL Injection
Yoast Duplicate Post
≤2.5Update to 2.6
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
- Medium6.1Cross-Site Scripting
WP Symposium
≤11.11.26Update to 11.12.08
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium6.1Cross-Site Scripting
Adminimize
≤1.7.21Update to 1.7.22
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2